Wireshark doesn’t read same IPv6 fragment offset value from pcap as microsoft network monitor

Question

I found an interesting issue from below pcap log: https://www.dropbox.com/s/g7fgpmhcepy2yw5/04_05_FragmentHeader.cap?dl=0

For 2nd packet, wireshark reads fragment offset value in fragment reader as '181' while Microsoft Network Monitor interpret it as '1448'. It looks like a bug to me.

Wondering anyone else is seeing the same ?

PS: I am using Version 1.12.1 (v1.12.1-0-g01b65bf from master-1.12)

Answer 1

Per RFC 2460:

Fragment Offset: 13-bit unsigned integer.  The offset, in 8-octet
                 units, of the data following this header,
                 relative to the start of the Fragmentable Part
                 of the original packet.

What Wireshark is displaying is the raw value in 8 bytes unit, not the number of bytes. 181*8 = 1448.